Over the previous few months, a large-scale cloud storage subscription rip-off marketing campaign has been focusing on customers worldwide with repeated emails falsely warning recipients that their photographs, recordsdata, and accounts are about to be blocked or deleted on account of an alleged cost failure.
Primarily based on quite a few emails seen by BleepingComputer, the marketing campaign has escalated over the previous few months, with folks receiving a number of variations of the rip-off every day, all showing to be despatched by the identical scammers.
Whereas the e-mail textual content, the messages all try and create a way of urgency by claiming a cost downside or storage challenge have to be resolved instantly, or folks’s recordsdata might be deleted or blocked.
The cloud storage rip-off e mail marketing campaign
The phishing emails originate from a variety of domains, with most showing to be randomly generated for the spam marketing campaign, as proven within the pattern checklist beneath.
xavpy@njyihuhzhyjumdjenwdsugjsku.us
hxsupportxf@bjmbsjabnjjvdfdlntduihco.com
zwblygwgtrmwag.18445435479309@qqjon7.oleglp.4mzrly.us
[name]-6704@ucv9q.333.sb100014.tour.za.comThe emails themselves use all kinds of topic traces, all designed to scare a recipient into opening the e-mail.
Instance topic traces seen by BleepingComputer embrace:
- Speedy Motion Required. Cost Declined
- Cloud Storage 1TB: Cost overdue
- [personal name]¸Your Account Has been Blocked! Your Photographs and Movies might be Eliminated Fri,30 Jan-2026. take motion!!
- We have blocked your account! Your photographs and movies might be deleted . Renew your subscription without cost now!
- [personal name] – Your retailer is full , click on to verify and save 80% , ID#88839
- [personal name], Your Cloud Account has been locked on Mon,26 Jan-2026. Your photographs and movies might be eliminated!
- Sorry [
], We Have To Droop Your Account In the present day ! Sat,24 Jan-2026 - [name] – Your retailer is full , click on to verify and save 80%
- Cloud Storage 1TB: Cost overdue
Most of the topic traces are personalised with the recipient’s title or e mail deal with and embrace particular dates or identifiers to extend urgency and make the messages seem authentic.
The e-mail seen by BleepingComputer declare {that a} cloud subscription renewal failed or {that a} cost methodology has expired, with recipients warned that backups could cease syncing and that photographs, movies, paperwork, and machine backups might be misplaced if the difficulty shouldn’t be resolved.
Supply: BleepingComputer
The emails seen by BleepingComputer declare {that a} cloud subscription renewal failed or {that a} cost methodology has expired, and warn recipients that backups could cease syncing and that photographs, movies, paperwork, and machine backups might be misplaced if the difficulty shouldn’t be resolved.
The messages continuously embrace made-up account IDs, subscription numbers, and expiration dates so as to add legitimacy.
“Your Cloud Subscription Is at Danger. We could not course of your most up-to-date cost. If not resolved, your Cloud storage and backups could also be paused,” reads an e mail seen by BleepingComputer.
“Speedy Motion Required Please confirm or replace your cost methodology as quickly as doable to keep away from dropping entry to your photographs, recordsdata, and machine backups.”
All spam emails on this marketing campaign contained a hyperlink to which is a part of Google Cloud Storage, the place risk actors hosted static redirector HTML recordsdata. When a customer clicks this, the URL redirects them to a rip-off/phishing web site hosted on random domains.
All the hyperlinks examined by BleepingComputer result in the identical set of rip-off pages.
The phishing pages impersonate cloud service portals and prominently show cloud-themed branding, together with the Google Cloud brand. The net pages declare the consumer’s cloud storage is full and warn that photographs, movies, contacts, recordsdata, and personal knowledge are not being backed up and might be deleted.
“Since you’ve exceeded your storage plan, your paperwork, contacts, and machine knowledge are not backing as much as Cloud and your photographs and movies are usually not importing to Cloud Photographs. Cloud Drive and Cloud-enabled apps are usually not updating throughout your units,” reads the phishing web site proven beneath.
“Your knowledge might be misplaced with out safety safety if no pressing motion is taken.”
Supply: BleepingComputer
Clicking on the “Proceed” button brings targets to a faux storage scan that all the time stories that Photographs, Cloud Drive, and Mail are all full. The pages then warn that knowledge might be misplaced until the cloud storage is upgraded, claiming that the individual is eligible for a limited-time “loyalty” improve at an 80% low cost.
Nevertheless, after clicking the replace storage button, as a substitute of being taken to a authentic cloud providers web page, you might be redirected to internet affiliate marketing pages selling unrelated merchandise.
Merchandise promoted on this phishing marketing campaign embrace VPN providers, little-known safety software program, and different subscription-based choices with no connection to cloud storage.
The pages in the end result in checkout types designed to gather bank card particulars and generate affiliate income for the risk actors behind the marketing campaign.
Sadly, many individuals who obtain these emails could not understand they’re scams and buy a product they do not want, considering it would remedy the faux cloud storage points.
You will need to perceive that these emails and touchdown pages are usually not authentic cloud service notifications. Moreover, authentic cloud suppliers don’t ship emails that result in storage scans or third-party safety or VPN merchandise to resolve billing points.
Moreover, most authentic cloud storage suppliers will block entry to your further storage whenever you fail to make a cost, somewhat than deleting your recordsdata instantly.
For instance, Google says that if a Google Drive plan is canceled, you’ll lose entry to your further storage till you make a cost once more, and your recordsdata will solely be deleted after 2 years.
Microsoft OneDrive follows the same method however says it could delete recordsdata after 6 months if the account exceeds its allotted storage.
Customers who obtain these spam messages ought to delete them with out clicking any hyperlinks and never buy something promoted by way of the emails.
Because the marketing campaign’s purpose is to scare recipients into pointless purchases, ignoring these messages is the perfect plan of action.
Any considerations about cloud storage or billing ought to as a substitute be checked manually by visiting the official web site or app of the authentic cloud service.
It is funds season! Over 300 CISOs and safety leaders have shared how they’re planning, spending, and prioritizing for the 12 months forward. This report compiles their insights, permitting readers to benchmark methods, establish rising developments, and examine their priorities as they head into 2026.
Find out how prime leaders are turning funding into measurable affect.
